The present invention relates to a system for detecting the malfunction of a CPU (Central Processing Unit) and, more particularly, to a system which allows a person to see the number of times that a CPU has malfuntioned.
The prerequisite witch an apparatus needing high reliability is that the malfunction of the apparatus be detected to allow processing matching the result of detection to be executed. An automobile telephone, for example, has to be highly reliable since it uses public electromagnetic waves. It is a common practice with an automobile telephone to provide a CPU with a diagnosing function. When circuitry governed by the CPU malfunctions, the CPU with the diagnosing function interrupts the ordinary operation and thereby inhibits the telephone from being used until the cause of malfunction has been removed by, for example, repair at a maintenance division. For example, when a malfunction occurs in a transmitting circuit, the CPU displays a message such as "TRANSMITTER ERROR" on a display and stops accepting commands other than a power off command. Further, the malfunction of the CPU itself is apt to impair public transactions by unusual electromagnetic waves. In the light of this, the automobile telephone is also provided with a mechanism for preventing the CPU from malfunctioning. This kind of mechanism is usually referred to as a fault tolerance mechanism.
The automobile telephone deals with the malfunction of the CPU by incorporating a watchdog timer therein. After the watchdog timer has been reset by the CPU, it interrupts the CPU on detecting the elapse of a predetermined period of time on the basis of a clock which is independent of a clock applied to the CPU. Specifically, the CPU resets the watchdog timer at a period shorter than the above-mentioned period of time, so that it may be interrupted as soon as it malfunctions. When the CPU malfunctions and is interrupted by the watchdog timer, it stops the processing under way and, instead, executes predetermined interrupt processing. The malfunction of the CPU is partly ascribable to noise or a similar cause which rarely occurs and partly ascribable to a CPU fault or a similar cause which occurs relatively frequently. It is, therefore, difficult to find the cause of the malfunction of the CPU. This, coupled with the fact that the probability of error reproduction is extremely low, causes the interrupt processing to simply reset the hardware of the automobile telephone.
Simply resetting the hardware as stated above is undesirable since the user of the automobile telephone cannot recognize the malfunction of the CPU and, therefore, cannot see if the CPU is in a stable state. Moreover, regarding CPU errors of the kind not occurring more than a predetermined frequency, their causes cannot be easily found even at a maintenance division. Hence, when the product is brought to a maintenance division to remove the cause of a different kind of CPU error, it is often returned to the user without the cause relating to the malfunction of the CPU being removed.